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REMARKS 

The final Office Action mailed May 3, 2007 has been carefully reviewed and the 
foregoing amendment has been made in consequence thereof. 

Claims 1-25, 27, 28, 30-56, 58, 60-89, and 119-122 are now pending in this 
application. Claims 1-25, 27-56, 58-89, and 119-122 stand rejected. Claims 29 and 59 have 
been canceled. 

The rejection of Claims 1-25, 27-56, 58-89, and 119-122 under 35 U.S.C. § 101 as 
being directed to non-statutory subject matter is respectfully traversed. 

The Office Action asserts that Claims 1, 16-18, 24, 31, 63, and 76 are directed to non- 
statutory subject matter because the "result of the invention is not considered to be concrete." 
Specifically, the Office Action asserts; "Because of the fact that different people may ascribe 
different values to the variables used in the equation, and because no guidance is given on 
how to go about choosing the values for the 'detection rating', 'severity rating', and 'process 
strength rating', the result is not guaranteed. The claim is not statutory because the result is 
not concrete (i.e. it is not capable of being repeated due to the human factor)." Applicants 
respectfully traverse this assertion. Applicants respectfully submit that the mere fact that 
certain variables used to calculate a score may be measured by a person, such as an 
experienced risk assessor, does not mean that the score is non-repeatable or that the invention 
fails to produce a concrete result. 

To be patentable, "the process must have a result that can be substantially repeatable 
or the process must substantially produce the same result again. In re Swartz , 232 F.3d 862, 
864, 56 USPQ2d 1703, 1704 (Fed, Cir. 2000) . . . Resolving this question is dependent on the 
level of skill in the art. For example, if the claimed invention is for a process which requires 
a particular skill, to determine whether that process is substantially repeatable will 
necessarily require a determination of the level of skill of the ordinary artisan in that field" 
(Emphasis added.) See MPEP § 2106(IV)(C)(2)(2)(c). Applicants submit that an 
experienced risk assessor would understand, after reading the originally filed specification 
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and reviewing the figures, how to value the detection rating, severity rating, and process 
strength rating such that the present invention is repeatable. 

More specifically, regarding independent Claims 1,31, 63, and 76, Applicants submit 
that the specification clearly describes how the "detection rating" is valued. For example, the 
specification provides as follows: 

Also, issues relating to risk are identified, for example, determination of 
potential failures and root causes of the failures. The cross functional 
resource team is reassembled in order to execute extensive failure mode 
and effects analysis (FMEA) on the top three to five compliance 
requirements risks identified in the RPM above. Referring to Figure 14, a 
flowchart 200 illustrating process steps executed in addressing the top 
three to five compliance requirements risks identified in the RPM is 
shown. After mapping 202 steps for each risk, for example by giving each 
process step in the risk a name that clearly identifies the step, the risks are 
analyzed by the team to determine 204 potential failure modes. The effect 
of each failure mode is determined 206 by the team who then try to 
identify 208 the potential causes of each failure mode. The high-risk 
process steps are mapped 202 and a failure mode and effects analysis 
matrix (FMEA) is constructed. In constructing the FMEA a severity 
rating, current controls in place are listed 210, a likelihood of occurrence 
factor and a detection ability factor is assigned 212 based on a standard 
rating system which is part of the knowledge base in server 12, Server 12 
is configured to use the rating system and the entered factors to calculate 
214 risk prioritization numbers (RPNs). Next, recommended actions to 
reduce RPNs are determined 216 by the team. Specifically, and in one 
embodiment, a RPN enables the team to prioritize actions for 
implementation and allocate resources effectively to reduce the RPN. In a 
specific embodiment, progress in reducing an RPN is monitored and team 
actions are guided by system 10 using the knowledge base stored within 
server 12. (Para. 0081.) 

Severity rating, occurrence and detection factors previously assigned 212 
(shown in Figure 14), also are part of FMEA matrix 230. In one 
embodiment, the severity-rating for the QFD matrix during prioritization 
of the risk is entered into a severity rating column 246 in FMEA matrix 
230. Then, the values for occurrence and detection are calculated using 
any standard rating system. In one embodiment, the standard rating 
system includes values from one to ten. An occurrence factor measures^ 
the likelihood of occurrence of non-compliance. The likelihood of 
occurrence measures the frequency of non-compliance in the process with 
a value of one indicating a remote likelihood up to a value of ten 
representing that failure is assured. The ability to detect (detection) uses a 
similar numerical scheme with a value of one meaning that if there is 
noncompliance, the potential failure will be found or prevented to a value 
often representing absolute certainty that current controls will not detect 
potential failures or there are no controls in place. The severity rating, 
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occurrence and detection factors are then entered into the FMEA matrix 
230 under a severity column 246, an occurrence column 248, and a 
detection factor column 250 respectively, (Emphasis added.) (Para. 
0084.) 

Applicants therefore respectfully submit that the specification clearly describes how 
the detection rating variable is valued. Accordingly, Applicants respectfully submit that the 
claimed invention is directed to statutory subject matter because the present invention as 
claimed produces a useful, concrete, and tangible result. The mere fact that a variable may be 
measured by a person, such as an experienced risk assessor, does not mean that the invention 
as claimed produces a result that is not concrete. As cited from the MPEP above, the key 
question as to "whether that process is substantially repeatable will necessarily require a 
determination of the level of skill of the ordinary artisan in that field." See MPEP § 
2106(IV)(C)(2)(2)(c), Applicants submit that one of ordinary skill in the art, such as an 
experienced risk assessor, would understand the valuation of a variable such as a detection 
rating after reading the originally filed specification. Therefore, Applicants submit that 
independent Claims 1,31, 63, and 76 are patentable. 

Moreover, the Office Action asserts that dependent Claims 16-18, depending from 
independent Claim 1, are directed to non-statutory subject matter. Specifically, the Office 
Action asserts that "[b]ecause all of the variables used to calculate the QFD score are 
disclosed as being determined by people, the result of the invention is not considered to be 
concrete (i.e., it is not capable of being repeated to arrive at a particular result)." Applicants 
respectfully traverse this assertion. The mere fact that the "process strength rating" and 
"severity rating" variables used to calculate the QFD score may be measured by a person 
does not mean that the score is non-repeatable or that the invention fails to produce a concrete 
result. As stated above, the key question as to "whether that process is substantially 
repeatable will necessarily require a determination of the level of skill of the ordinary artisan 
in that field." See MPEP § 2106(IV)(C)(2)(2)(c). 

Specifically, Applicants submit that the specification clearly describes how the 
"process strength rating" and "severity rating" are valued and how the QFD score is 
calculated. For example, the specification provides as follows: 
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The severity rating for non-compliance of each compliance requirement is 
entered into risk QFD matrix 180. The severity rating may be any known 
severity rating. In one specific embodiment, the numerical value that is 
entered into risk QFD matrix 1 80 is entered into a top row 1 82 labeled 
"SEVERITY." The numerical value is based upon the damage to 
reputation and/or financial scores. In the one specific embodiment, a 
value often signifies damage to the reputation of the company or financial 
impact affecting more than ten percent of net income. A value of five 
signifies damage to the reputation to the business or financial impact 
affecting more than five percent but less than ten percent of net income. 
A value of one means damage to the reputation to the business region or 
financial impact affecting less than five percent of net income. A value of 
zero denotes no damage to reputation or any financial impact. 
Alternatively, different weighting formulas can be used. (Para. 0075.) 

Further, the process strength of a business routines and controls is assessed 
to ensure compliance with each policy. In one specific embodiment, the 
assessment is accomplished by rating, or quantifying, the strength of the 
compliance routines and controls to ensure compliance with the policy. 
The process strength rating may be accomplished by any known rating 
system. In one specific embodiment, a score of ten means that there is no 
process or no level of policy awareness, A score of seven indicates an 
inconsistent process, no documentation or sporadic, ad hoc generic 
training. A score of three means that there is no enforced process, limited 
enforced process or no regular specific training. A score of zero means 
that there is no interaction or no process is necessary. This score is used to 
calculate a QFD score for quantifying the results. (Para. 0076.) 

The score is then entered into risk QFD matrix 180. Figure 13 illustrates 
one embodiment of a completed risk QFD matrix 190 including a QFD 
score 192. The QFD score 192 may be calculated by any known method. 
In one specific embodiment, server 12 is configured to calculate the QFD 
score as: 

severity rating x process strength rating. 

The QFD score 192 is entered for each policy compliance area 152. The 
QFD score 192 is also used for identifying the immediate risks to the 
business. The higher the QFD score 192, the more immediate the risk to 
the business. (Para, 0077-0079.) 

Applicants therefore respectfully submit that the specification clearly describes how 
the "process strength rating" and "severity rating" variables are valued and how the QFD 
score is calculated. Accordingly, Applicants respectfully submit that the claimed invention is 
directed to statutory subject matter because the present invention as claimed produces a 
useful, concrete, and tangible result. The mere fact that these variables may be measured by 
a person, such as an experienced risk assessor, does not mean that the invention as claimed 
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produces a result that is not concrete. As cited from the MPEP above, the key question as to 
"whether that process is substantially repeatable will necessarily require a determination of 
the level of skill of the ordinary artisan in that field." See MPEP § 2106(IV)(C)(2)(2)(c). 
Applicants submit that one of ordinary skill in the art, such as an experienced risk assessor, 
would necessarily understand the valuation of variables such as a "process strength rating" 
and a "severity rating" and the calculation of a QFD score after reading the originally filed 
specification. Therefore, Applicants submit that dependent Claims 16-18 are patentable. 

The Office Action further asserts that dependent Claim 24, depending from 
independent Claim 1, is non- statutory. Specifically, the Office Action asserts that for the 
variables used to calculate an RPN, "the values used in the equation are determined by people 
and are judgmental in nature; therefore, the claim does not have a concrete result," 
Applicants respectfully traverse this assertion. As stated above, the key question as to 
"whether that process is substantially repeatable will necessarily require a determination of 
the level of skill of the ordinary artisan in that field." See MPEP § 2106(IV)(C)(2)(2)(c). 

The specification clearly describes how the RPN is calculated and how the "severity 
rating", "occurrence rating", and "detection rating" variables are valued. Accordingly, 
Applicants respectfully submit that the claimed invention is directed to statutory subject 
matter because the present invention as claimed produces a useful, concrete, and tangible 
result. Applicants submit that one of ordinary skill in the art, such as an experienced risk 
assessor, would necessarily understand the valuation of variables such as a "severity rating", 
"occurrence rating", and "detection rating" and the calculation of an RPN score after reading 
the originally filed specification. Therefore, Applicants submit that dependent Claim 24 is 
patentable. 

Although it is not stated in the Office Action, Applicants make the assumption that 
dependent Claims 2-25, 27-30, 33-56, 58-62, 64-75, 77-89, and 119-122 have been rejected 
under Section 101 based on being dependent on rejected base claims. 

Applicants respectfully submit that independent Claim 1 is in condition for allowance. 
Claim 29 has been canceled. Claims 2-25, 27, 28, 30, and 1 19 depend, directly or indirectly, 
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from Claim 1. When the recitations of dependent Claims 2-25, 27, 28, 30, and 119 are 
considered in combination with the recitations of independent Claim 1, Applicants submit 
that dependent Claims 2-25, 27, 28, 30, and 1 19 are likewise in condition for allowance. 

Applicants respectfully submit that independent Claim 31 is in condition for 
allowance. Claims 32-56, 58, 60-62, and 120 depend, directly or indirectly, from Claim 31. 
When the recitations of dependent Claims 32-56, 58, 60-62, and 120 are considered in 
combination with the recitations of independent Claim 31, Applicants submit that dependent 
Claims 32-56, 58, 60-62, and 120 are likewise in condition for allowance. 

Applicants respectfully submit that independent Claim 63 is in condition for 
allowance. Claims 64-75 and 121 depend, directly or indirectly, from Claim 63. When the 
recitations of dependent Claims 64-75 and 121 are considered in combination with the 
recitations of independent Claim 63, Applicants submit that dependent Claims 64-75 and 121 
are likewise in condition for allowance. 

Applicants respectfully submit that independent Claim 76 is in condition for 
allowance. Claims 77-89 and 122 depend, directly or indirectly, from Claim 76. When the 
recitations of dependent Claims 77-89 and 122 are considered in combination with the 
recitations of independent Claim 76, Applicants submit that dependent Claims 77-89 and 122 
are likewise in condition for allowance. 

For at least the reasons set forth above, Applicants respectfully request that the 
Section 101 rejection of Claims 1-25, 27-56, 58-89, and 119-122 be withdrawn. 

The rejection of Claims 1-25, 27-56, 58-89, and 119-122 under 35 U.S.C. § 112, first 
paragraph, as failing to comply with the enablement requirement is respectfully traversed. 

The Office Action asserts that Claims 1, 31, 63, and 76 fail to comply with the 
enablement requirement. Specifically, the Office Action asserts that "[people] determine 
what the detection rating is going to be, and no guidance is given on how to go about 
choosing the value for the detection rating." Applicants traverse this assertion. 
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'The test of enablement is whether one reasonably skilled in the art could make or use 
the invention from the disclosures in the patent coupled with information known in the art 
without undue experimentation." (Emphasis added.) United States v. Telectronics, Inc. , 857 
F.2d 778, 785, 8 USPQ2d 1217, 1223 (Fed, Cir. 1988). Moreover, a patent need not provide 
what is well known in the art. (Emphasis added.) In re Buchner , 929 F.2d 660, 661, 18 
USPQ2d 1331, 1332 (Fed. Cir. 1991). See MPEP § 2164.01. Applicants submit that the 
specification, including the Figures, would enable one of ordinary skill in the art, such as an 
experienced risk assessor, to make and/or use the invention as described. 

Moreover, Applicants submit that one of ordinary skill in the art, such as an 
experienced risk assessor, after reading the specification would understand how a "detection 
rating" value is assigned. For example, see Paragraph 0081, recited above, which provides "a 
detection ability factor is assigned 212 based on a standard rating system." Further, see 
Paragraph 0084, also recited above, which provides "In one embodiment, the standard rating 
system includes values from one to ten . , . The ability to detect (detection) uses a similar 
numerical scheme with a value of one meaning that if there is noncompliance, the potential 
failure will be found or prevented to a value of ten representing absolute certainty that current 
controls will not detect potential failures or there are no controls in place." 

Accordingly, Applicants respectfully submit that the specification, including the 
Figures, would enable one of ordinary skill in the art, such as an experienced risk assessor, to 
make and/or use the invention. Therefore, Applicants submit that independent Claims 1,31, 
63, and 76 are fully enabled and patentable. Accordingly, Applicants respectfully request 
that the rejection of Claims 1, 31, 63, and 76 under Section 112, first paragraph, be 
withdrawn. 

The Office Action also asserts that Claims 32, 33, 35, and 36 fail to comply with the 
enablement requirement. Specifically, the Office Action asserts that for Claims 32, 33, 35, 
and 36, "[o]ne of skill in the art would not be able to make the server do what is claimed and 
undue experimentation would be required." Applicants traverse this assertion. For example, 
a server may be configured to assemble a cross functional team using the knowledge base 
which lists possible members of the cross functional team. Use of a server to invite possible 
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members to a team is a known use for both servers and knowledge bases. Moreover, the 
specification describes in paragraph 0057 that the "identification 74 of the process owner is 
conducted using the knowledge base, which also includes any information relevant to 
identifying 74 interviewees ... in one embodiment, the knowledge base includes a question 
owner's matrix 76." Accordingly, Applicants submit that one of ordinary skill in the art, such 
as an experienced risk assessor, after reading the specification would understand the use of a 
server and knowledge base to assemble a cross functional team and to identify interviewees 
using a question owner's matrix. 

Moreover, the Office Action asserts that, regarding Claim 34, "one of skill in the art 
would not be able to go about and make a server that can create a questionnaire as claimed." 
Applicants traverse this assertion. The specification provides as follows: 

Interviews 78 are conducted with process owners for area compliance 
program status. As used herein interviewing means receiving information. 
Interviewing includes receiving information via a questionnaire, which 
may be stored within server 12 as part of the knowledge base. As 
described above, the knowledge base is stored in a central database within 
server 12 and may include a questionnaire spreadsheet 80. (Emphasis 
added.) (Para. 0059.) 

Accordingly, Applicants submit that one of ordinary skill in the art, such as an 
experienced risk assessor, after reading the specification would understand the use of a server 
and knowledge base to create a questionnaire. 

The Office Action also asserts that, regarding Claims 37 and 38, "[o]ne of skill in the 
art would not know how to go about and make the server do what is claimed." Applicants 
traverse this assertion. Compiling results on a server is well known in the art and would be 
understood by one of ordinary skill in the art after reading the specification. For example, the 

specification provides: 

In one embodiment, interview results are compiled using a questionnaire 
template spreadsheet. Figure 6 illustrates one embodiment of a 
questionnaire template spreadsheet 120. The interview questions 122 
asked for each compliance assessment area 124 are entered into template 
120 Answers 126 to the questions are also entered into template 120. 
Template 120 is stored in server 12, and using hidden columns, server 12, 
automatically converts the qualitative results on the spreadsheet to 
quantitative results. For example, an affirmative answer is automatically 
converted to a numerical entry of'l ". Qualitative answers 128 that are 
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collected during interviews are also input into template 120. Qualitative 
answers 128 may include, for example, current program details, tools 
used, action plans y owner, completion date and best practices. In another 
specific embodiment, an answer 126 of "not applicable" triggers a switch 
to indicate that a question should not be added into the count in the 
analysis of the results. (Emphasis added.) (Para. 0064.) 

Server 12 is also configured to add the "ones" of the affirmative answers 
and to tabulate and graph the results automatically when commanded, 
typically by a functional or compliance leader. Specifically, Figure 7 is an 
embodiment of a questionnaire metrics chart 130 generated using answers 
126 entered into template 120 (shown in Figure 6), Questionnaire metrics 
chart 130 includes, for example, the percent of compliance 132 in each 
compliance assessment area 124. Percent of compliance 132 is the ratio of 
the number of questions for which an answer was expected 134, also 
called "Opps" for opportunities and a score 136, which is the total number 
of "ones" in a particular compliance assessment area 124. (Emphasis 
added.) (Para- 0065.) 

Accordingly, Applicants submit that one of ordinary skill in the art, such as an 
experienced risk assessor, after reading the specification would understand the use of a server 
to compile interview results. 

Further, regarding Claims 39-42, the Office Action asserts that the "server does not 
compile the various requirements [but rather] it is an employee that compiles the 
requirements." Applicants traverse this assertion. Specifically, the specification provides as 
follows: 

In addition, risks are prioritized. Resources used to prioritize risk may 
include functional leaders, compliance leaders, compliance experts, policy 
owners, a management team, and legal counsel. Risk prioritization is used 
to assess the compliance risk, relating the risk to processes, products and 
environments and identifying and prioritizing the highest risk(s). 
Prioritization of the risk(s) is performed by mapping a high-level risk 
model and compiling a list of compliance requirements. Next, the list of 
compliance requirements is prioritized and construction of a quality 
function deployment (QFD) matrix is started using system 10. A severity 
rating for non-compliance with the requirements is entered by a designee 
of the resource team listed above, and the compliance policies are assessed 
and valuated. Finally, the immediate risks are identified, construction of 
the QFD matrix is completed and the compliance risk areas are prioritized. 
(Emphasis added.) (Para. 0068,) 

Subsequently, a list of compliance requirements is compiled and 
prioritized by the resource team. The list of compliance requirements is 
compiled and prioritized by using and adding to database 18 stored on 
server 1 2 (shown in Figures 1 and 2). Database 1 8 includes, for example, 
the core compliance areas within the business' declared policies and 
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procedures (referred to as the business Spirit and Letter), regulatory and 
legal requirements of the business, contractual and internal policy 
requirements, and compliance risks noted in business risk model 160 
(shown in Figure 10), As described above, the list of compliance 
requirements also is prioritized. In an exemplary embodiment, the list of 
compliance requirements is prioritized by the resource team based on the 
severity rating of non-compliance. Severity ratings are generated using 
stored and newly added knowledge base information relevant to severity. 
The knowledge base includes information relating to how a compliance 
expert, in a worst case scenario situation, would rate damage to the 
business reputation and/or the financial impact to a business. The 
knowledge base may be specific to individual business processes and 
products. For example, when a business reputation is damaged, the 
severity rating of non-compliance is high when it has a company impact, 
medium when it has a division impact and low when it has only a regional 
impact. The list of compliance requirements is organized in accordance 
with a severity matrix format. Accordingly, in one specific embodiment, 
the financial impact of non-compliance is rated high when there is an 
impact greater than ten percent of net income, medium when the impact is 
greater than five percent, but less than ten percent, of net income, and low 
when it has an impact affecting less than five percent of net income. 
Alternatively, different weighting formulas can be used. (Emphasis 
added.) (Para. 0070.) 

Once the severity rating of each compliance requirement on the list has 
been rated, the compliance requirements are organized and entered into a 
severity matrix format stored on server 12, Figure 1 1 is an embodiment of 
a severity matrix 170 + The severity rating of non-compliance ranges from 
a low level 172 of non-compliance to a high level 174 of non-compliance. 
Both core compliance requirements 176, including spirit and letter and 
regulatory requirements, and secondary compliance requirements 1 78, 
including contractual and internal policy requirements, are prioritized by 
the resource team based on this severity rating scale. (Emphasis added.) 
(Para. 0073.) 

Accordingly, Applicants submit that one of ordinary skill in the art, such as an 
experienced risk assessor, after reading the specification would understand the use of a server 
to prioritize compliance risks, map a high level business risk model, compile and prioritize a 
list of compliance requirements. 

Applicants also traverse the assertion in the Office Action that Claims 43-62 are not 
enabled. Applicants submit that one of ordinary skill in the art, such as an experienced risk 
assessor, after reading the specification would understand the use of a server to compile a list 
of compliance requirements, prioritize risks, assign severity ratings, map a risk model, and 
assign occurrence and detection factors, among other recitations of Claims 43-62. 
Specifically, Applicants submit that one of ordinary skill in the art, such as an experienced 
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risk assessor, after reading the specification would understand the use of a server to complete 
these tasks as they are understood in the art. Servers can be configured and/or programmed 
to do a multitude of compilation and/or evaluation tasks such as those described in the 
specification. One of ordinary skill in the art would understand the abilities of a server such 
as the server described in the present invention. 

The Office Action also asserts that, in general, Claims 31-89 fail to comply with the 
enablement requirement. Specifically, the Office Action asserts that for Claims 31-89, 
"Applicant has not given enough disclosure to enable one of skill in the art to make a 
computer system that has a server that does everything that is claimed/' Applicants traverse 
this assertion. 

Applicants respectfully submit that the specification, including the Figures, satisfies 
the enablement requirement. Specifically, Applicants submit that one skilled in the art, such 
as an experienced risk assessor, after reading the specification, including the Figures, would 
understand how the server is used within the recited system. More specifically, Applicants 
submit that the specification clearly describes a knowledge base that is stored within the 
database. The server is configured to access and utilize the knowledge base in combination 
with additional information that is provided to the server through a user interface. The server 
is therefore able to execute the steps recited in Claims 31-89. For example, prioritizing 
compliance risks is provided in the specification as follows: 

Server 12 is configured to assess compliance, prioritize risk benchmark 
existing programs, identify improvement opportunities, and identify 
potential best practices as part of a compliance program, A user interface 
allows a user to input data relating to the identification and quantification 
of a company's compliance process and to receive identification and 
quantification of compliance output. A computer-based compliance 
identification and quantification tool, as described below in more detail, is 
stored in server computer 12 and can be accessed by a requester at any one 
of computers 14. (Para. 0048.) 

In addition, risks are prioritized. Resources used to prioritize risk may 
include functional leaders, compliance leaders, compliance experts, policy 
owners, a management team, and legal counsel. Risk prioritization is used 
to assess the compliance risk, relating the risk to processes, products and 
environments and identifying and prioritizing the highest risk(s). 
Prioritization of the risk(s) is performed by mapping a high-level risk 
model and compiling a list of compliance requirements. Next, the list of 
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compliance requirements is prioritized and construction of a quality 
function deployment (QFD) matrix is started using system 70. A severity 
rating for non-compliance with the requirements is entered by a designee 
of the resource team listed above, and the compliance policies are assessed 
and valuated. Finally, the immediate risks are identified, construction of 
the QFD matrix is completed and the compliance risk areas are prioritized, 
(Para. 0068.) 

Applicants submit that one of ordinary skill in the art, such as an experienced risk 
assessor, would understand that the database, including the knowledge base, is used with the 
server to prioritize risks by mapping a high-level risk model and compiling a list of 
compliance requirements, A database, as would be understood by one of ordinary skill in the 
art, would be useful for mapping exercises due to the ease of linking tables or rows. 

Moreover, the server's ability to identify compliance failure modes, potential causes 
and effects of the failure modes, current controls in place, and a detection rating is provided 
in Paragraph 0081 of the specification, recited above. Applicants submit that one of ordinary 
skill in the art, such as an experienced risk assessor, would understand that the database, 
including the knowledge base, is used with the server to identify issues relating to risks. 

Further, the knowledge base is used by the server to complete many other steps. For 
example, the specification provides as follows; 

Assessment of a compliance program is used to benchmark existing 
programs, identify improvement opportunities and identify potential best 
practices. Referring to Figure 3, a flowchart 70 for process steps executed 
in assessing at least one compliance program is shown. More specifically, 
server 12 (shown in Figures 1 and 2) is configured to facilitate steps 
described in Figure 3. First, a cross-functional team is assembled 72 to 
determine what constitutes compliance. The cross-functional team may 
have members from all functional areas of a business having knowledge of 
compliance policies and how they relate to their function area. The cross- 
functional team is assembled 72 using a knowledge base which is stored 
on server 12 and may include any information relevant to the assembly 72 
of a cross-functional team, (Emphasis added.) (Para. 0056.) 

Respective process owners are identified 74 for interviews during which a 
questionnaire regarding compliance is completed. The identification 74 of 
the process owner is conducted using the knowledge base, which also 
includes any information relevant to identifying 74 interviewees. 
Accordingly \ and in one embodiment, the knowledge base includes a 
question owner's matrix 76. (Emphasis added,) (Para. 0056.) 
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In one embodiment, server 12 is configured to use the knowledge base to 
determine what constitutes an affirmative answer to a question in the 
questionnaire. Compliance is largely dependent upon the particular 
circumstances of each business. Accordingly, the knowledge base may 
include, for example, information from compliance leaders and 
information relevant to each business and for each environment. The 
knowledge base may also include standards for minimum program 
qualities and the level of documentation required for proof in answering 
the question which sets a standard used as a guide through the interviews 
with process owners, (Emphasis added.) (Para. 0056.) 

Interviews 78 are conducted with process owners for area compliance 
program status. As used herein interviewing means receiving information. 
Interviewing includes receiving information via a questionnaire, which 
may be stored within server 12 as part of the knowledge base. As 
described above, the knowledge base is stored in a central database within 
server 12 and may include a questionnaire spreadsheet 80. (Emphasis 
added.) (Para, 0056.) 

In one embodiment, interviews 78 (shown in Figure 3) are conducted in 
accordance with a question owner's matrix. More specifically, Figure 4 
shows one embodiment of a question owner's matrix 100, A question 
owner's matrix 1 00 is used as a guideline for identifying an interviewee 
for each sub-group of questions. The question owner's matrix 100 is 
constructed using the knowledge base within server 12. The knowledge 
base may include any information relevant to conducting an interview 
relating to compliance. The knowledge base may include, for example, 
information associating a group of questions with relevant functional 
knowledge, a summary of the details of program current status, 
improvement opportunities, identification of action item owners and a list 
of potential best practices. the question owner's matrix 100 lists 
compliance assessment areas 102, Compliance assessment areas 102 are 
any areas of a business that are being reviewed for compliance. Examples 
of compliance assessment areas 102 include, but are not limited to 
infrastructure, equal employment opportunity, antitrust, trade controls, 
ethical business practices and supplier relationships. The question owner's 
matrix 100 may also identify potential interviewees 104 by function for 
each area assessment using the knowledge base. Examples of 
interviewees 104 include, but are not limited to engineering, marketing, 
manufacturing, legal, purchasing, finance, and human resources, 
(Emphasis added.) (Para. 0056.) 

Applicants respectfully submit that the operation of the server, in conjunction with the 
knowledge base, is fully and clearly described by the specification. Applicants have recited 
part of the specification by way of example. However, Applicants submit that one of 
ordinary skill in the art, such as an experienced risk assessor, would understand and be able to 
use and/or make the invention based on the specification and Figures. Applicants submit that 
the recitations of Claims 31-89, including all dependent claims, are fully enabled and 
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patentable. Accordingly, Applicants respectfully request that the rejection of Claims 31-89 
under Section 1 12, first paragraph, be withdrawn. 

Although it is not stated in the Office Action, Applicants make the assumption that 
dependent Claims 2-25, 27-30, 33-56, 58-62, 64-75, 77-89, and 119-122 have been rejected 
under Section 101 based on being dependent on rejected base claims. 

Applicants respectfully submit that independent Claim 1 is in condition for allowance. 
Claim 29 has been canceled. Claims 2-25, 27, 28, 30, and 1 19 depend, directly or indirectly, 
from Claim 1. When the recitations of dependent Claims 2-25, 27, 28, 30, and 119 are 
considered in combination with the recitations of independent Claim 1, Applicants submit 
that dependent Claims 2-25, 27, 28, 30, and 1 19 are likewise in condition for allowance. 

Applicants respectfully submit that independent Claim 31 is in condition for 
allowance. Claim 59 has been canceled. Claims 32-56, 58, 60-62, and 120 depend, directly 
or indirectly, from Claim 3L When the recitations of dependent Claims 32-56, 58, 60-62, 
and 120 are considered in combination with the recitations of independent Claim 31, 
Applicants submit that dependent Claims 32-56, 58, 60-62, and 120 are likewise in condition 
for allowance. 

Applicants respectfully submit that independent Claim 63 is in condition for 
allowance. Claims 64-75 and 121 depend, directly or indirectly, from Claim 63. When the 
recitations of dependent Claims 64-75 and 121 are considered in combination with the 
recitations of independent Claim 63, Applicants submit that dependent Claims 64-75 and 121 
are likewise in condition for allowance. 

Applicants respectfully submit that independent Claim 76 is in condition for 
allowance. Claims 77-89 and 122 depend, directly or indirectly, from Claim 76. When the 
recitations of dependent Claims 77-89 and 122 are considered in combination with the 
recitations of independent Claim 76, Applicants submit that dependent Claims 77-89 and 122 
are likewise in condition for allowance. 
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For at least the reasons set forth above, Applicants respectfully request that the 
Section 112, first paragraph, rejection of Claims 1-25, 27-56, 58-89, and 119-122 be 
withdrawn. 

The rejection of Claims 2, 5, 8, 11, 29, 32, 34, 39, 50, and 59 under 35 U,S,C. § 112, 
second paragraph, as being indefinite is respectfully traversed. 

Applicants respectfully submit that Claims 2, 5, 8, 11, 29, 32, 34, 39, 50, and 59 
satisfy Section 1 12, second paragraph. Claims 29 and 59 have been canceled- Specifically, 
Applicants submit that Claims 2, 5, 8, 11, 32, 34, 39, and 50 are definite and particularly 
point out and distinctly claim the subject matter of the invention. 

Claims 2 and 8 have been amended to address the Examiner's concerns regarding the 
recitation "identifying and interviewing a plurality of process owners for the questionnaire 
answers," Claims 32, 34, and 50 do not include the recitation and have not been amended. 
Accordingly, Applicants respectfully submit that amended Claims 2, 8, 32 ? 34, and 50 are 
definite. 

Claim 5 has been amended to address the Examiner's concerns regarding the 
recitation "reassembling the cross-functional team" and the recitation "calculating the RPNs." 
Accordingly, Applicants respectfully submit that amended Claim 5 is definite. 

Claim 11 has been amended to address the Examiner's concerns. However, 
Applicants respectfully traverse the assertion in the Office Action with respect to Claim 39 
that "[t]here is no antecedent basis for 'the list of compliance requirements/" Specifically, 
Claim 39 recites a "server configured to , . , compile a list of compliance requirements, 
prioritize the list of compliance requirements...." Applicants therefore respectfully submit 
that Claims 1 1 and 39 are definite. 

The Examiner states in the Office Action that Claims 29 and 59 are indefinite, 
because one wishing to avoid infringement would not know what a "policy dashboard" is. 
Claim 29 has been canceled and independent Claim 1 has been amended to include this 
recitation. Claim 59 has been canceled and independent Claim 31 has been amended to 
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include this recitation. Applicants respectfully submit that one skilled in the art would know 
that a dashboard, in computer technology, is a tool used to visually determine the health or 
status of a system and to provide easy identification of such items as warnings, tasks, and 
summaries. In the current invention, a policy dashboard is used as a monitoring and 
reporting tool. For example, Figure 20, shows a dashboard of the present invention. 

For at least the reasons set forth above, Applicants respectfully request that the 
Section 112, second paragraph, rejection of Claims 2, 5, 8, 11, 29, 32, 34, 39, 50, and 59 be 
withdrawn. 

The rejection of Claims 1-16, 18-23, 25, 27-45, 47-53, 55, 56, 58-89, and 119-122 
under 35 U.S.C. § 103(a) as being unpatentable over U.S. Publication No. 2002/0120642 to 
Fetherston (hereinafter referred to as "Fetherston") is respectfully traversed. 

Applicants respectfully submit that Fetherston does not describe or suggest the 
claimed invention. At least one of the differences between Fetherston and the present 
invention is that Fetherston does not describe, suggest, or even mention creating at least one 
policy dashboard summarizing actions to be taken based on the recommended actions and 
key metrics for monitoring the implementation of the actions. Moreover, Applicants submit 
that Fetherston does not describe or suggest storing in the database compliance information 
including persons responsible for compliance within each functional area within the business. 
Applicants submit that it is not necessary for every employee within a particular department 
or functional area is necessarily a person responsible for compliance. 

Furthermore, Applicants submit that Fetherston does not describe or suggest 
calculating a risk prioritization number (RPN) for each compliance risk identified based on 
the data stored in the database, wherein the RPN represents a relative compliance risk of a 
particular failure mode including the current controls in place and the detection rating. 

Fetherston describes a system for assisting an organization to implement and maintain 
compliance management programs. The system includes a plurality of modules relating to 
particular compliance obligations. Specifically, the system includes a master database 
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containing information on the compliance obligations, a slave database containing 
information and activities (i.e., incidents or accidents) in the organization and assessments of 
the organization. More specifically, the master database includes input/output devices where 
a user may access a plurality of modules wherein each module is related to a particular piece 
of legislation, and the module is presented to the user on a display device. The display device 
also includes a plurality of sub-modules such as text documents that are stored in a storage 
unit and memory for display on a display unit when selected by the user. The user may select 
a sub-module that displays a risk assessment form permitting the user to enter and store data 
in the slave database about hazards in an organization about which the user has knowledge, 
such as an accident or a workplace ergonomics issue. The sub-module forces the user to 
follow a process and pattern of data entry into the various risk assessment forms. Once the 
data is entered by the user, the data is stored in the slave database. Fetherston also describes 
a risk assessment means that compares data in the slave database to compliance criteria from 
the master database. Specifically, the risk assessment means determines a numerical priority 
or risk assessment rating as the product of severity and frequency. A rating that exceeds a 
certain rating is brought to the attention of the user. Moreover, Fetherston describes that 
reports detailing particular hazards may be produced. 

Claim 1 recites a method for conducting a consistent, documented and yet repeatable 
compliance risk assessment and mitigation process using a network-based system including a 
server system coupled to a centralized database and at least one client system. The method 
includes "storing in the database compliance information including at least one 
questionnaire relating to compliance, compliance requirements for each functional area 
within a business, and persons responsible for compliance within each functional area within 
the business . . . displaying a questionnaire on a client system associated with a person 
responsible for compliance with at least one functional area within the business, the 
questionnaire is transmitted from the server system to the client system of the compliance 
person and is generated using the compliance information stored within the database . . . 
receiving at the server a response inputted by the compliance person to the displayed 
questionnaire . . . processing the response to the displayed questionnaire at the server . , . 
prioritizing compliance risks for the business including identifying compliance risks for each 
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functional area within the business, and prioritizing the compliance risks from high to low 
based on a severity rating of non-compliance . . . identifying, for each compliance risk 
identified, potential compliance failure modes, potential causes and effects of such 
compliance failure modes, current controls in place, and a detection rating, wherein the 
detection rating is a value representing whether current controls in place will detect potential 
compliance failure modes . . . storing the risks, the risk priority, the failure modes, the causes 
and effects of the failure modes, the current controls in place, and the detection ratings in the 
database . . . calculating a risk prioritization number (RPN) for each compliance risk 
identified based on the data stored in the database, wherein the RPN represents a relative 
compliance risk of a particular failure mode and is directly related to the current controls in 
place and the detection rating . . . implementing risk monitoring and control mechanisms to 
mitigate compliance risks based on the calculated RPNs including recommending actions to 
be implemented to reduce the calculated RPNs . . . creating at least one policy dashboard 
summarizing actions to be taken based on the recommended actions and key metrics for 
monitoring the implementation of the actions" (Emphasis added.) 

Fetherston does not describe or suggest a method as recited in Claim 1. More 
specifically, Fetherston does not describe or suggest a method for conducting a compliance 
risk assessment and mitigation process that includes calculating a risk prioritization number 
(RPN) for each compliance risk identified based on the data stored in the database, wherein 
the RPN represents a relative compliance risk of a particular failure mode and is directly 
related to the current controls in place and the detection rating. Moreover, Applicants submit 
that Fetherston does not describe or suggest creating at least one policy dashboard 
summarizing actions to be taken based on the recommended actions and key metrics for 
monitoring the implementation of the actions. Further, Fetherston does not describe or 
suggest storing in the database compliance information including persons responsible for 
compliance within each functional area within the business. 

Rather, in contrast to the present invention, Fetherston describes a system for assisting 
an organization to implement and maintain compliance management programs. The system 
includes a master database containing information on the compliance obligations, a slave 
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database containing information and activities, such as incidents or accidents in the 
organization, and assessments of the organization. The system allows any user to input 
information into the slave database, such as knowledge of improper operating conditions 
and/or improper ergonomic working conditions. However, Fetherston does not describe or 
suggest a method for conducting a compliance risk assessment and mitigation process as 
recited in Claim 1, For example, Fetherston does not describe or suggest a method for 
conducting a compliance risk assessment and mitigation process that includes calculating a 
risk prioritization number (RPN) for each compliance risk identified based on the data stored 
in the database, wherein the RPN represents a relative compliance risk of a particular failure 
mode and is directly related to the current controls in place and the detection rating. 

In fact, the Office Action asserts at page 1 1 that the system described by Fetherston 
"prioritizes the compliance risk for a business by identifying the compliance risks and 
prioritizing them from high to low based on a severity rating/' The Office Action also asserts 
that paragraph 0042 of Fetherston describes "the identification of hazards (risks) that exceed 
a certain rating." Applicants traverse these assertions. The RPN calculation recited in Claim 
1 is not based merely on a severity rating. Rather, the RPN calculation is based on the data 
stored in the database, including the current controls in place for the compliance risk and the 
detection rating of the compliance risk. 

Moreover, Fetherston does not describe, suggest, or even mention creating at least one 
policy dashboard summarizing actions to be taken based on the recommended actions and 
key metrics for monitoring the implementation of the actions. 

Furthermore, Fetherston does not describe or suggest storing in the database 
compliance information including persons responsible for compliance within each functional 
area within the business. 

The Office Action asserts at page 1 1 that "[identifying the department also identifies 
the persons responsible for compliance (i.e., the employees in that department)." Fetherston 
fails to teach the step of storing compliance information including a plurality of process 
owners responsible for compliance within each functional area within the business. 
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Moreover, Applicants traverse the assertion that "one of ordinary skill in the art would have 
been motivated to do what is claimed." There is no motivation disclosed to identify process 
owners within each functional area. A process may be owned by, for example, one employee 
within a functional area or by more than one but not all employees within a functional area. 

Accordingly, for at least the reasons set forth above, Claim 1 is submitted to be 
patentable over Fetherston. 

Claim 29 has been canceled. Claims 2-16, 18-23, 25, 27, 28, 30, and 119 depend 
from independent Claim 1. When the recitations of Claims 2-16, 18-23, 25, 27, 28, 30, and 
119 are considered in combination with the recitations of Claim 1 , Applicants submit that 
dependent Claims 2-16, 18-23, 25, 27, 28, 30, and 119 likewise are patentable over 
Fetherston. 

Claim 31 recites a system for identifying and quantifying compliance. The system 
includes "at least one computer . . . a database for storing compliance information including 
at least one questionnaire relating to compliance, compliance requirements for each 
functional area within a business, and persons responsible for compliance within each 
functional area within the business ... a server ... a network connecting said computer to 
said server, wherein said server configured to display a questionnaire on said computer 
associated with a person responsible for compliance with at least one functional area within 
the business, said network is configured to transmit the questionnaire from said server to said 
computer of the compliance person and is generated using the compliance information stored 
within the database, said server is configured to: receive a response inputted by the 
compliance person to the displayed questionnaire . . . process the response to the displayed 
questionnaire . . . prioritize compliance risks for the business including identifying 
compliance risks for each functional area within the business, and prioritizing the compliance 
risks from high to low based on a severity rating of non-compliance . . . identify, for each 
compliance risk identified, potential compliance failure modes, potential causes and effects of 
such compliance failure modes, current controls in place, and a detection rating, wherein the 
detection rating is a value representing whether current controls in place will detect potential 
compliance failure modes . . . store the risks, the risk priority, the failure modes, the causes 

41 



60709-00012 
PATENT 

and effects of the failure modes, the current controls in place, and the detection ratings in the 
database , , . calculate a risk prioritization number (RPN) for each compliance risk identified 
based on the data stored in the database, wherein the RPN represents a relative compliance 
risk of a particular failure mode and is directly related to the current controls in place and 
the detection rating . . . recommend risk monitoring and control mechanisms to mitigate 
compliance risks based on the calculated RPNs including recommending actions to be 
implemented to reduce the calculated RPNs , . . create at least one policy dashboard 
summarizing actions to be taken based on the recommended actions and key metrics for 
monitoring the implementation of the actions" (Emphasis added,) 

Claim 31, as amended herein, recites a system for identifying and quantifying 
compliance that includes a server configured to perform steps essentially similar to those 
recited in Claim 1. Thus, Applicants submit that Claim 31 is patentable over Fetherston for 
reasons that correspond to those given with respect to Claim 1. 

Claim 59 has been canceled. Claims 32-45, 47-53, 55, 56, 58, 60-62, and 120 depend 
from independent Claim 31, When the recitations of Claims 32-45, 47-53, 55, 56, 58, 60-62, 
and 120 are considered in combination with the recitations of Claim 31, Applicants submit 
that dependent Claims 32-45, 47-53, 55, 56, 58, 60-62, and 120 likewise are patentable over 
Fetherston. 

Claim 63 recites a computer programmed to "store in a database compliance 
information including at least one questionnaire relating to compliance, compliance 
requirements for each functional area within a business, and persons responsible for 
compliance within each functional area within the business . . , display a questionnaire for a 
person responsible for compliance with at least one functional area within the business, the 
questionnaire is generated using the compliance information stored within the database . . . 
receive a response inputted by the compliance person to the displayed questionnaire . . . 
process the response to the displayed questionnaire . . . prioritize compliance risks for the 
business including identifying compliance risks for each functional area within the business, 
and prioritizing the compliance risks from high to low based on a severity rating of non- 
compliance . . . identify, for each compliance risk identified, potential compliance failure 
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modes, potential causes and effects of such compliance failure modes, current controls in 
place, and a detection rating, wherein the detection rating is a value representing whether 
current controls in place will detect potential compliance failure modes . . . store the risks, the 
risk priority, the failure modes, the causes and effects of the failure modes, the current 
controls in place, and the detection ratings in the database . . . calculate a risk prioritization 
number (RPN) for each compliance risk identified based on the data stored in the database, 
wherein the RPN represents a relative compliance risk of a particular failure mode and is 
directly related to the current controls in place and the detection rating . . . recommend risk 
monitoring and control mechanisms to mitigate compliance risks based on the calculated 
RPNs including recommending actions to be implemented to reduce the calculated RPNs . . . 
create at least one policy dashboard summarizing actions to be taken based on the 
recommended actions and key metrics for monitoring the implementation of the actions" 
(Emphasis added,) 

Claim 63, as amended herein, recites a system for identifying and quantifying 
compliance that includes a server configured to perform steps essentially similar to those 
recited in Claim 1. Thus, Applicants submit that Claim 63 is patentable over Fetherston for 
reasons that correspond to those given with respect to Claim 1. 

Claims 64-75 and 121 depend from independent Claim 63. When the recitations of 
Claims 64-75 and 121 are considered in combination with the recitations of Claim 63, 
Applicants submit that dependent Claims 64-75 and 121 likewise are patentable over 
Fetherston. 

Claim 76 recites a computer program embodied on a computer readable medium for 
managing compliance risk assessment to enable businesses to develop broader and deeper 
coverage of compliance risks, using a network based system including a server system 
coupled to a centralized database and at least one client system. The computer program 
includes a code segment that "stores in the database compliance information including at 
least one questionnaire relating to compliance, compliance requirements for each functional 
area within a business, and persons responsible for compliance within each functional area 
within the business . . . displays a questionnaire on a client system associated with a person 
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responsible for compliance with at least one functional area within the business, the 
questionnaire is transmitted from the server system to the client system of the compliance 
person and is generated using the compliance information stored within the database . . . 
receives a response inputted by the compliance person to the displayed questionnaire . , . 
processes the response to the displayed questionnaire at the server . . . prioritizes compliance 
risks for the business including identifying compliance risks for each functional area within 
the business, and prioritizing the compliance risks from high to low based on a severity rating 
of non-compliance . . . identifies, for each compliance risk identified, potential compliance 
failure modes, potential causes and effects of such compliance failure modes, current controls 
in place, and a detection rating, wherein the detection rating is a value representing whether 
current controls in place will detect potential compliance failure modes . . . stores the risks, 
the risk priority, the failure modes, the causes and effects of the failure modes, the current 
controls in place, and detection ratings in the database . . . calculates a risk prioritization 
number (RPN) for each compliance risk identified based on the data stored in the database, 
wherein the RPN represents a relative compliance risk of a particular failure mode and is 
directly related to the current controls in place and the detection rating . . . recommends risk 
monitoring and control mechanisms to mitigate compliance risks based on the calculated 
RPNs including recommending actions to be implemented to reduce the calculated RPNs . . . 
creates at least one policy dashboard summarizing actions to be taken based on the 
recommended actions and key metrics for monitoring the implementation of the actions" 

Claim 76, as amended herein, recites a system for identifying and quantifying 
compliance that includes a server configured to perform steps essentially similar to those 
recited in Claim 1. Thus, Applicants submit that Claim 76 is patentable over Fetherston for 
reasons that correspond to those given with respect to Claim 1 , 

Claims 77-89 and 122 depend from independent Claim 76. When the recitations of 
Claims 77-89 and 122 are considered in combination with the recitations of Claim 76, 
Applicants submit that dependent Claims 77-89 and 122 likewise are patentable over 
Fetherston, 
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For at least the reasons set forth above, Applicants respectfully request that the 
Section 103 rejection of Claims 1-16, 18-23, 25, 27-45, 47-53, 55, 56, 58-89, and 119-122 be 
withdrawn. 

In view of the foregoing amendment and remarks, all the claims now active in this 
application are believed to be in condition for allowance. Reconsideration and favorable 
action is respectfully solicited. 

Respectfully submitted, 




Daniel M. Fitzgerala 
Registration No, 38,880 
ARMSTRONG TEASDALE LLP 
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